CVE-2026-50656

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50656", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-06-05T14:33:50.831Z", "datePublished": "2026-06-16T18:01:33.601Z", "dateUpdated": "2026-11-10T23:24:11.631Z"}, "containers": {"cna": {"title": "Microsoft Defender Elevation of Privilege Vulnerability", "datePublic": "2026-06-16T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.1.0.0", "versionEndExcluding": "1.1.26060.3008"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Malware Protection Engine", "versions": [{"version": "1.1.0.0", "lessThan": "1.1.26060.3008", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "lang": "en-US", "type": "CWE", "cweId": "CWE-59"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-11-10T23:24:11.631Z"}, "references": [{"name": "Microsoft Defender Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C"}}]}, "adp": [{"references": [{"url": "https://github.com/MSNightmare/ShieldBreak", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-17T03:56:00.813025Z", "id": "CVE-2026-50656", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T16:04:56.605Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50656", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-17T03:56:00.813025Z"}}}], "references": [{"url": "https://github.com/MSNightmare/ShieldBreak", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T18:36:21.914Z"}}], "cna": {"title": "Microsoft Defender Elevation of Privilege Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Malware Protection Engine", "versions": [{"status": "affected", "version": "1.1.0.0", "lessThan": "1.1.26060.3008", "versionType": "custom"}]}], "datePublic": "2026-06-16T14:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656", "name": "Microsoft Defender Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet "."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.1.26060.3008", "versionStartIncluding": "1.1.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-11-10T23:24:11.631Z"}}}, "cveMetadata": {"cveId": "CVE-2026-50656", "state": "PUBLISHED", "dateUpdated": "2026-11-10T23:24:11.631Z", "dateReserved": "2026-06-05T14:33:50.831Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-06-16T18:01:33.601Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Microsoft Malware Protection Engine", "vendor": "Microsoft", "versions": [{"lessThan": "1.1.26060.3008", "status": "affected", "version": "1.1.0.0", "versionType": "custom"}]}], "source": "secure@microsoft.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:malware_protection_engine:-:*:*:*:*:*:*:*", "matchCriteriaId": "1CF44512-0B67-4B5F-B271-C8CA45D30DA8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet "."}, {"lang": "es", "value": "Microsoft tiene conocimiento de una elevaci\u00f3n de privilegios en el Motor de Protecci\u00f3n de Malware de Microsoft Defensor, conocida p\u00fablicamente como \u2019RoguePlanet\u2019. Estamos trabajando para proporcionar una actualizaci\u00f3n de seguridad de alta calidad que aborda esta vulnerabilidad. Proporcionaremos informaci\u00f3n en este CVE cuando la actualizaci\u00f3n est\u00e9 disponible."}], "id": "CVE-2026-50656", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50656", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-17T03:56:00.813025Z", "version": "2.0.3"}}]}, "published": "2026-06-16T19:16:59.683", "references": [{"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/MSNightmare/ShieldBreak"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "secure@microsoft.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Microsoft Malware Protection Engine", "source": "cna", "vendor": "Microsoft"}, "product": "malware_protection_engine", "vendor": "microsoft"}], "created": "2026-06-16T19:30:16.635907+00:00", "updated": "2026-10-25T19:30:14.986950+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$malware_protection_engine"]}